@spfn/auth 0.2.0-beta.80 → 0.2.0-beta.81

package/dist/server.js

@@ -6977,6 +6977,38 @@ var init_schema5 = __esm({
         })
       },
       // ============================================================================
+      // OAuth Configuration - GitHub
+      // ============================================================================
+      SPFN_AUTH_GITHUB_CLIENT_ID: {
+        ...envString({
+          description: "GitHub OAuth app client ID. When set, GitHub OAuth routes are automatically enabled.",
+          required: false,
+          examples: ["Iv1.abc123def456"]
+        })
+      },
+      SPFN_AUTH_GITHUB_CLIENT_SECRET: {
+        ...envString({
+          description: "GitHub OAuth app client secret.",
+          required: false,
+          sensitive: true,
+          examples: ["your-github-client-secret"]
+        })
+      },
+      SPFN_AUTH_GITHUB_SCOPES: {
+        ...envString({
+          description: 'Comma-separated GitHub OAuth scopes. Defaults to "read:user,user:email".',
+          required: false,
+          examples: ["read:user,user:email"]
+        })
+      },
+      SPFN_AUTH_GITHUB_REDIRECT_URI: {
+        ...envString({
+          description: "GitHub OAuth callback URL. Defaults to {NEXT_PUBLIC_SPFN_APP_URL || SPFN_APP_URL}/_auth/oauth/github/callback.",
+          required: false,
+          examples: ["https://app.example.com/_auth/oauth/github/callback"]
+        })
+      },
+      // ============================================================================
       // Native Social Login (mobile/web id_token verification)
       //
       // 네이티브 SDK가 받은 id_token을 서버가 JWKS로 검증하는 경로 전용 설정.
@@ -9346,7 +9378,7 @@ async function updateUserProfileService(userId, params) {
 // src/server/services/oauth.service.ts
 init_repositories();
 import { env as env11 } from "@spfn/auth/config";
-import { ValidationError as ValidationError8 } from "@spfn/core/errors";
+import { ValidationError as ValidationError9 } from "@spfn/core/errors";
 import { AccountDisabledError as AccountDisabledError2, AccountPendingDeletionError as AccountPendingDeletionError2 } from "@spfn/auth/errors";
 
 // src/server/lib/oauth/google.ts
@@ -9667,9 +9699,142 @@ var appleProvider = {
 };
 registerOAuthProvider(appleProvider);
 
-// src/server/lib/oauth/kakao-provider.ts
+// src/server/lib/oauth/github-provider.ts
 init_config();
 import { ValidationError as ValidationError6 } from "@spfn/core/errors";
+var GITHUB_AUTH_URL = "https://github.com/login/oauth/authorize";
+var GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+var GITHUB_USERINFO_URL = "https://api.github.com/user";
+var GITHUB_EMAILS_URL = "https://api.github.com/user/emails";
+var GITHUB_USER_AGENT = "spfn-auth";
+var GITHUB_DEFAULT_EXPIRES_IN = 60 * 60 * 24 * 365;
+function getGithubConfig() {
+  const clientId = env3.SPFN_AUTH_GITHUB_CLIENT_ID;
+  const clientSecret = env3.SPFN_AUTH_GITHUB_CLIENT_SECRET;
+  if (!clientId || !clientSecret) {
+    throw new ValidationError6({
+      message: "GitHub OAuth is not configured. Set SPFN_AUTH_GITHUB_CLIENT_ID and SPFN_AUTH_GITHUB_CLIENT_SECRET."
+    });
+  }
+  const baseUrl = env3.NEXT_PUBLIC_SPFN_APP_URL || env3.SPFN_APP_URL;
+  return {
+    clientId,
+    clientSecret,
+    redirectUri: env3.SPFN_AUTH_GITHUB_REDIRECT_URI || `${baseUrl}/_auth/oauth/github/callback`
+  };
+}
+function getGithubScopes() {
+  const configured = env3.SPFN_AUTH_GITHUB_SCOPES;
+  return configured ? configured.split(",").map((scope) => scope.trim()).filter(Boolean) : ["read:user", "user:email"];
+}
+async function requestGithubTokens(params) {
+  const response = await fetch(GITHUB_TOKEN_URL, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: params
+  });
+  if (!response.ok) {
+    throw new Error(`GitHub token request failed with status ${response.status}`);
+  }
+  const body = await response.json();
+  if (typeof body.error === "string") {
+    throw new Error(`GitHub token request failed: ${body.error}`);
+  }
+  if (typeof body.access_token !== "string") {
+    throw new Error("GitHub token response is invalid");
+  }
+  const expiresIn = Number(body.expires_in);
+  return {
+    accessToken: body.access_token,
+    refreshToken: typeof body.refresh_token === "string" ? body.refresh_token : void 0,
+    expiresIn: Number.isFinite(expiresIn) && expiresIn > 0 ? expiresIn : GITHUB_DEFAULT_EXPIRES_IN
+  };
+}
+async function fetchPrimaryEmail(accessToken) {
+  const response = await fetch(GITHUB_EMAILS_URL, {
+    headers: {
+      "Authorization": `Bearer ${accessToken}`,
+      "Accept": "application/vnd.github+json",
+      "User-Agent": GITHUB_USER_AGENT
+    }
+  });
+  if (!response.ok) {
+    return null;
+  }
+  const entries = await response.json();
+  if (!Array.isArray(entries)) {
+    return null;
+  }
+  const primary = entries.find((entry) => entry.primary === true && typeof entry.email === "string") ?? entries.find((entry) => entry.verified === true && typeof entry.email === "string");
+  return primary ? { email: primary.email, verified: primary.verified === true } : null;
+}
+var githubProvider = {
+  id: "github",
+  isEnabled() {
+    return !!(env3.SPFN_AUTH_GITHUB_CLIENT_ID && env3.SPFN_AUTH_GITHUB_CLIENT_SECRET);
+  },
+  getAuthUrl(state, scopes) {
+    const config2 = getGithubConfig();
+    const params = new URLSearchParams({
+      client_id: config2.clientId,
+      redirect_uri: config2.redirectUri,
+      state,
+      scope: (scopes ?? getGithubScopes()).join(" ")
+    });
+    return `${GITHUB_AUTH_URL}?${params.toString()}`;
+  },
+  async exchangeCodeForTokens(code) {
+    const config2 = getGithubConfig();
+    return requestGithubTokens(new URLSearchParams({
+      client_id: config2.clientId,
+      client_secret: config2.clientSecret,
+      redirect_uri: config2.redirectUri,
+      code
+    }));
+  },
+  async getUserInfo(accessToken) {
+    const response = await fetch(GITHUB_USERINFO_URL, {
+      headers: {
+        "Authorization": `Bearer ${accessToken}`,
+        "Accept": "application/vnd.github+json",
+        "User-Agent": GITHUB_USER_AGENT
+      }
+    });
+    if (!response.ok) {
+      throw new Error(`GitHub user-info request failed with status ${response.status}`);
+    }
+    const body = await response.json();
+    if (typeof body.id !== "number" && typeof body.id !== "string") {
+      throw new Error("GitHub user-info response is missing the provider user ID");
+    }
+    const primaryEmail = await fetchPrimaryEmail(accessToken);
+    const publicEmail = typeof body.email === "string" ? body.email : null;
+    return {
+      providerUserId: String(body.id),
+      email: primaryEmail?.email ?? publicEmail,
+      emailVerified: primaryEmail?.verified ?? false,
+      name: typeof body.name === "string" ? body.name : typeof body.login === "string" ? body.login : void 0,
+      avatar: typeof body.avatar_url === "string" ? body.avatar_url : void 0
+    };
+  },
+  async refreshTokens(refreshToken) {
+    const config2 = getGithubConfig();
+    return requestGithubTokens(new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: config2.clientId,
+      client_secret: config2.clientSecret,
+      refresh_token: refreshToken
+    }));
+  }
+};
+registerOAuthProvider(githubProvider);
+
+// src/server/lib/oauth/kakao-provider.ts
+init_config();
+import { ValidationError as ValidationError7 } from "@spfn/core/errors";
 var KAKAO_AUTH_URL = "https://kauth.kakao.com/oauth/authorize";
 var KAKAO_TOKEN_URL = "https://kauth.kakao.com/oauth/token";
 var KAKAO_USERINFO_URL = "https://kapi.kakao.com/v2/user/me";
@@ -9677,7 +9842,7 @@ function getKakaoConfig() {
   const clientId = env3.SPFN_AUTH_KAKAO_CLIENT_ID;
   const clientSecret = env3.SPFN_AUTH_KAKAO_CLIENT_SECRET;
   if (!clientId) {
-    throw new ValidationError6({
+    throw new ValidationError7({
       message: "Kakao OAuth is not configured. Set SPFN_AUTH_KAKAO_CLIENT_ID."
     });
   }
@@ -9779,7 +9944,7 @@ registerOAuthProvider(kakaoProvider);
 
 // src/server/lib/oauth/naver-provider.ts
 init_config();
-import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+import { ValidationError as ValidationError8 } from "@spfn/core/errors";
 var NAVER_AUTH_URL = "https://nid.naver.com/oauth2.0/authorize";
 var NAVER_TOKEN_URL = "https://nid.naver.com/oauth2.0/token";
 var NAVER_USERINFO_URL = "https://openapi.naver.com/v1/nid/me";
@@ -9787,7 +9952,7 @@ function getNaverConfig() {
   const clientId = env3.SPFN_AUTH_NAVER_CLIENT_ID;
   const clientSecret = env3.SPFN_AUTH_NAVER_CLIENT_SECRET;
   if (!clientId || !clientSecret) {
-    throw new ValidationError7({
+    throw new ValidationError8({
       message: "Naver OAuth is not configured. Set SPFN_AUTH_NAVER_CLIENT_ID and SPFN_AUTH_NAVER_CLIENT_SECRET."
     });
   }
@@ -9881,12 +10046,12 @@ registerOAuthProvider(naverProvider);
 function requireEnabledProvider(provider) {
   const oauthProvider = getOAuthProvider(provider);
   if (!oauthProvider) {
-    throw new ValidationError8({
+    throw new ValidationError9({
       message: `Unsupported OAuth provider: ${provider}. No provider is registered for this id.`
     });
   }
   if (!oauthProvider.isEnabled()) {
-    throw new ValidationError8({
+    throw new ValidationError9({
       message: `OAuth provider '${provider}' is registered but not configured. Check its required environment variables.`
     });
   }
@@ -9894,7 +10059,7 @@ function requireEnabledProvider(provider) {
 }
 function tokenExpiryDate(expiresIn) {
   if (!Number.isFinite(expiresIn)) {
-    throw new ValidationError8({
+    throw new ValidationError9({
       message: `Invalid token expiry returned from OAuth provider: ${expiresIn}`
     });
   }
@@ -9920,12 +10085,12 @@ async function oauthCallbackService(params) {
   const stateData = await verifyOAuthState(state);
   const nonceCandidates = typeof expectedNonce === "string" ? [expectedNonce] : expectedNonce ?? [];
   if (!stateData.nonce || !nonceCandidates.includes(stateData.nonce)) {
-    throw new ValidationError8({
+    throw new ValidationError9({
       message: "OAuth state validation failed"
     });
   }
   if (stateData.provider !== provider) {
-    throw new ValidationError8({
+    throw new ValidationError9({
       message: "OAuth state provider mismatch"
     });
   }
@@ -9991,7 +10156,7 @@ async function oauthCallbackService(params) {
 async function assertActiveForOAuthSession(userId) {
   const user = await usersRepository.findByIdOnPrimary(userId);
   if (!user) {
-    throw new ValidationError8({ message: "User not found" });
+    throw new ValidationError9({ message: "User not found" });
   }
   if (user.status === "active") {
     return;
@@ -10008,7 +10173,7 @@ async function createOrLinkUser(provider, identity, tokens, metadata) {
   let isNewUser = false;
   if (existingUser) {
     if (!identity.emailVerified) {
-      throw new ValidationError8({
+      throw new ValidationError9({
         message: "Cannot link to existing account with unverified email. Please verify your email with the provider first."
       });
     }
@@ -10079,7 +10244,7 @@ var TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1e3;
 async function getGoogleAccessToken(userId) {
   const account = await socialAccountsRepository.findByUserIdAndProvider(userId, "google");
   if (!account) {
-    throw new ValidationError8({
+    throw new ValidationError9({
       message: "No Google account linked. User must sign in with Google first."
     });
   }
@@ -10088,7 +10253,7 @@ async function getGoogleAccessToken(userId) {
     return account.accessToken;
   }
   if (!account.refreshToken) {
-    throw new ValidationError8({
+    throw new ValidationError9({
       message: "Google refresh token not available. User must re-authenticate with Google."
     });
   }
@@ -10103,12 +10268,12 @@ async function getGoogleAccessToken(userId) {
 
 // src/server/services/oauth-native.service.ts
 init_repositories();
-import { ValidationError as ValidationError9 } from "@spfn/core/errors";
+import { ValidationError as ValidationError10 } from "@spfn/core/errors";
 import { runInTransaction as runInTransaction2, onAfterCommit as onAfterCommit2 } from "@spfn/core/db";
 async function oauthNativeService(params) {
   const oauthProvider = getOAuthProvider(params.provider);
   if (!oauthProvider?.verifyNativeIdToken) {
-    throw new ValidationError9({
+    throw new ValidationError10({
       message: `Provider '${params.provider}' does not support native id_token sign-in.`
     });
   }
@@ -11145,7 +11310,7 @@ var deleteCookie = (c, name, opt) => {
 // src/server/routes/oauth/index.ts
 init_types();
 import { Transactional as Transactional3 } from "@spfn/core/db";
-import { ValidationError as ValidationError10 } from "@spfn/core/errors";
+import { ValidationError as ValidationError11 } from "@spfn/core/errors";
 import { rateLimitPolicy as rateLimitPolicy4 } from "@spfn/core/middleware";
 import { defineRouter as defineRouter4, route as route4 } from "@spfn/core/route";
 var providerParams = Type.Object({
@@ -11265,10 +11430,10 @@ var getGoogleOAuthUrl = route4.post("/_auth/oauth/google/url").input({
 }).use([rateLimitPolicy4("oauth-start", { limit: 20, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
   const { body } = await c.data();
   if (!isGoogleOAuthEnabled()) {
-    throw new ValidationError10({ message: "Google OAuth is not configured" });
+    throw new ValidationError11({ message: "Google OAuth is not configured" });
   }
   if (!body.state) {
-    throw new ValidationError10({
+    throw new ValidationError11({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -11363,7 +11528,7 @@ var getProviderOAuthUrl = route4.post("/_auth/oauth/:provider/url").input({
   const { params, body } = await c.data();
   const provider = requireEnabledProvider(params.provider);
   if (!body.state) {
-    throw new ValidationError10({
+    throw new ValidationError11({
       message: "OAuth state is required. Ensure the OAuth interceptor is configured."
     });
   }
@@ -12051,6 +12216,7 @@ export {
   getUserPermissions,
   getUserProfileService,
   getUserRole,
+  githubProvider,
   googleProvider,
   hasAllPermissions,
   hasAnyPermission,